CVE-2021-34422: Path traversal of file names in Keybase Client for Windows

Severity: critical (CVSS 9.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-11 · updated 2026-06-17
Weakness: CWE-22

Description

The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application which was not intended on their host machine. If a malicious user leveraged this issue with the public folder sharing feature of the Keybase client, this could lead to remote code execution.

Affected products

Zoom Video Communications Inc Keybase Client for Windows: before 5.7.0 — fixed in 5.7.0

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Keybase Client for Windows 5.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34422 or the next vulnerability affects your stack